Add generated filesystem round-trip and mutation property tests

[plx]

Parent epic

#31

Problem and impact

The existing suite has no model-level assertion that a generated guide can be parsed and verifies the filesystem it came from. That missing invariant allowed raw syntax-sensitive filenames, directory symlinks, empty roots, and zero indentation to ship despite all 127 tests passing.

Required properties

Build bounded generated temporary filesystem trees and assert, for every supported case:

filesystem -> dump -> parse/check -> verify(same filesystem) == success

Then mutate the tree and assert expected failure unless the guide explicitly permits omission:

• delete a represented item;
• rename it;
• change file to directory or vice versa;
• change nesting;
• add/remove entries around commented and uncommented placeholders; and
• alter case/normalization on relevant filesystems.

The generator corpus must include ordinary nesting, wide/deep trees, grammar metacharacters, choices/escapes, Unicode, whitespace, empty directories, exclusions, and every approved/rejected symlink/special-entry class. Unsupported names/types must generate a precise rejection property rather than be excluded from generation.

Required red-before-fix evidence

Seed deterministic regressions for:

• report plus report#draft;
• bracketed filename;
• literal ...;
• directory symlink;
• empty root/file-valued root;
• --indent 0; and
• malformed hierarchy fixture where appropriate.

Show those seeds fail against audited revision bf40806 before relying on randomized cases.

Implementation guidance

• Use deterministic seeds and bounded sizes so the normal suite is reproducible and fast.
• Separate portable names from platform-specific generators/capability checks.
• Keep output outside the enumerated root to avoid self-inclusion.
• Exercise both dump stdout and init file paths.
• Compare an independent filesystem model to the parsed guide; do not only call production code in a tautological cycle.
• Persist every discovered minimal counterexample as a named regression.

Acceptance criteria

• Deterministic historical seeds are red on the audited revision and green on the candidate.
• Supported generated trees round-trip exactly.
• Unsupported items always produce the approved error without partial misleading output.
• Filesystem mutations are detected according to partial-list/placeholder semantics.
• Tests run in bounded time on all supported platforms.
• Seeds/counterexamples are easy to reproduce from CI output.

Validation commands

cargo test --all-targets --all-features --locked
cargo test --all-targets --all-features --locked --release

Run a larger iteration count in scheduled/manual CI and record seed/case counts.

Relationships

• Parent: [Epic] Cross-platform assurance, test infrastructure, and performance #31
• Blocked by: Replace hierarchy reconstruction with a stack that rejects children under files #37, Require exact guide markers and strictly parse marker attributes #38, Make ignore=true semantics consistent across parser, CLI, recursive mode, and library API #39, Prevent parser normalization from losing separators or quoted whitespace #40, Escape syntax-sensitive names and reject names the guide format cannot represent #41, Classify symlinks and unsupported filesystem entries without following or mislabeling them #42, and Validate dump/init roots, empty output, depth, and indentation before generation #43
• Blocks final production reassessment.

Non-goals

Property tests supplement but do not replace each defect ticket's focused regression.

Approved #35 filesystem trust handoff

The maintainer-approved filesystem trust decision is recorded in PR #85 and the normative docs/v0.2-contract.md. It is a binding input to this issue, but it does not make the current runtime conformant.

Generated round-trip and mutation properties must wait for the relevant #43, #45, #49, and #51 behavior; the native blocker graph records the newly required #45/#49/#51 edges. Cover supported regular trees and the relevant generated/input/delivery rejection classes, explicit exclusions, root aliases, unresolved-parent spellings, sentinel non-disclosure, and create-new failure behavior without duplicating the focused owners' row suites.

Model a stable tree and observed mutation failures. Do not describe randomized mutation coverage as proof of hostile-concurrent-replacement safety or a sandbox.

Preserve the exact normative outcomes and focused ownership. If this issue changes runtime behavior, capture its own red-before-change evidence; coordinating work must not claim another issue's trust rows. Never claim sandbox or hostile-concurrent-replacement safety.